CVEs published in November 2023
31 tracked CVEs from 13 vendors had their first vendor advisory published in November 2023: 5 critical, 16 high, 1 in CISA KEV. Newest first.
25 more from this month are covered only by Red Hat's per-package records, listed on the Red Hat vendor page.
- Added
CVE-2021-36806Medium
Sophos Email: reflected XSS vulnerability allows an open redirect
Sophos · 1 advisory - Added
CVE-2023-45853Critical
Zlib Vulnerability in NetApp Products
NetApp · 1 advisory - Added
CVE-2023-3676High
Kubernetes Vulnerability in NetApp Products
NetApp · 1 advisory - Added
CVE-2023-22521High
Confluence: This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.6 of Crowd Data Center and Server
Atlassian · 1 advisory - Added
CVE-2023-22516High
Confluence: This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 8.1.0, 8.2.0, 9.0.0, 9.1.0, 9.2.0, and…
Atlassian · 1 advisory - Added
CVE-2023-46214High
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language…
Splunk · 1 advisory - Added
CVE-2023-46213Medium
In Splunk Enterprise versions below 9.0.7 and 9.1.2, ineffective escaping in the “Show syntax Highlighted” feature can
Splunk · 1 advisory - Added
CVE-2023-44466High
Linux Kernel Vulnerability in NetApp Products
NetApp · 1 advisory - Added
CVE-2023-41570Medium
RouterOS: MikroTik RouterOS v7.1 to 7.11 was discovered to contain incorrect access control mechanisms in place for the Rest API.
MikroTik · 1 advisory - Added
CVE-2023-45624High
Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series;: unauthenticated Denial-of-Service (DoS) vulnerability exists in the soft ap daemon accessed via the PAPI protocol
Aruba · 1 advisory - Added
CVE-2023-36641Medium
numeric truncation error vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiProxy 7.2.0 through 7.2.4, FortiProxy 7.0.0 through 7.0.10, FortiProxy 2.0 all versions, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions allows attacker to denial of service via specifically crafted HTTP requests
Fortinet · 1 advisory - Added
CVE-2023-42326High
issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code
pfSense · 1 advisory - Added
CVE-2023-42327Medium
Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges
pfSense · 1 advisory - Added
CVE-2023-42325Medium
Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges
pfSense · 1 advisory - Added
CVE-2023-28134High
Local attacker can escalate privileges on affected installations of Check Point Harmony Endpoint/ZoneAlarm Extreme Security
Check Point · 1 advisory - Added
CVE-2023-41285High
QuMagie: SQL injection vulnerability has been reported to affect QuMagie.
QNAP · 1 advisory - Added
CVE-2023-41284High
QuMagie: SQL injection vulnerability has been reported to affect QuMagie.
QNAP · 1 advisory - Added
CVE-2023-39295High
QuMagie: OS command injection vulnerability has been reported to affect QuMagie.
QNAP · 1 advisory - Added
CVE-2023-23367Medium
QTS: OS command injection vulnerability has been reported to affect several QNAP operating system versions.
QNAP · 1 advisory - Added
CVE-2023-29975High
issue discovered in Pfsense CE version 2.6.0 allows attackers to change the password of any user without verification
pfSense · 1 advisory - Added
CVE-2023-4379High
Incorrect Authorization in GitLab
GitLab · 1 advisory - Added
CVE-2023-29974Critical
issue discovered in Pfsense CE version 2.6.0 allows attackers to compromise user accounts via weak password requirements
pfSense · 1 advisory - Added
Allocation of Resources Without Limits or Throttling in GitLab
GitLab · 1 advisory - Added
CVE-2023-3399High
Insertion of Sensitive Information Into Sent Data in GitLab
GitLab · 1 advisory - Added
Insertion of Sensitive Information Into Sent Data in GitLab
GitLab · 1 advisory - Added
CVE-2023-46604CriticalCISA KEV
Apache ActiveMQ Deserialization of Untrusted Data Vulnerability
Commvault · 1 advisory - Added
CVE-2023-39301Medium
QTS: server-side request forgery (SSRF) vulnerability has been reported to affect several QNAP operating system versions.
QNAP · 1 advisory - Added
CVE-2023-39299High
Music Station: path traversal vulnerability has been reported to affect Music Station.
QNAP · 1 advisory - Added
CVE-2023-23369Critical
QTS: OS command injection vulnerability has been reported to affect several QNAP operating system versions.
QNAP · 1 advisory - Added
CVE-2023-23368Critical
QTS: OS command injection vulnerability has been reported to affect several QNAP operating system versions.
QNAP · 1 advisory - Added
CVE-2023-5178High
Kernel: use after free in nvmet_tcp_free_crypto in nvme
NetApp, Red Hat · 2 advisories